Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,72 % · rekomendacja wg zapisanej polityki
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,72 % · rekomendacja wg zapisanej polityki
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,72 % · rekomendacja wg zapisanej polityki
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,72 % · rekomendacja wg zapisanej polityki
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,7 % · rekomendacja wg zapisanej polityki